---
title: [OR] [AmB] [E2] [P2] [S1] [C9] Identifying Critical Business Services
description: [OR] [AmB] [E2] [P2] [S1] [C9] Identifying Critical Business Services
image: https://blog.bcm-institute.org/hubfs/Ambank%20Graphic%20Folder/Ambank%20E2%20Morepost/%5BOR%5D%20%5BAmB%5D%20%5BE2%5D%20%5BP2%5D%20%5BS1%5D%20%5BC9%5D%20Identifying%20Critical%20Business%20Services.jpg
---
. .
[](http://www.bcm-institute.org/)
- [Home](https://www.bcm-institute.org/)
- [About Us](https://www.bcm-institute.org/about-us-3/)
- [A President’s Perspective](https://www.bcm-institute.org/about-us/a-presidents-perspective/)
- [Our History](https://www.bcm-institute.org/about-us/our-history/)
- [Our Advisory Council](https://www.bcm-institute.org/about-us/our-advisory-council/)
- [Customers’ Testimonials](https://www.bcm-institute.org/about-us/customers-testimonials/)
- [Credential Verification](https://www.bcm-institute.org/about-us/credential-verification/)
- [Courses](https://blog.bcm-institute.org/blog/course-fees-for-blended-learning-courses-master-catalog)
- [ISO 22301 Business Continuity Management System Audit](https://blog.bcm-institute.org/audit/business-continuity-management-audit-courses)
- [ISO 22301 Business Continuity Management](https://blog.bcm-institute.org/bcm/business-continuity-management-courses)
- [Crisis Communication](https://blog.bcm-institute.org/crisis-communication/crisis-communication-courses)
- [Crisis Management](https://blog.bcm-institute.org/en/crisis-management/courses)
- [IT Disaster Recovery](https://blog.bcm-institute.org/it-disaster-recovery/courses)
- [Operational Resilience](https://blog.bcm-institute.org/operational-resilience/courses)
- [Operational Resilience Audit](https://blog.bcm-institute.org/operational-resilience-audit/courses)
- [Certification](https://blog.bcm-institute.org/certification/types-of-certifications-offered)
- [ISO 22301 BCMS Audit Certification](https://blog.bcm-institute.org/certification/business-continuity-management-audit-certification)
- [ISO22301 Business Continuity Management Certification](https://blog.bcm-institute.org/bcm/business-continuity-management-certification)
- [Crisis Communication Certification](https://blog.bcm-institute.org/crisis-communication/crisis-communication-certification)
- [Crisis Management Certification](https://blog.bcm-institute.org/en/crisis-management/crisis-management-certification)
- [IT Disaster Recovery Planning Certification](https://blog.bcm-institute.org/it-disaster-recovery/it-disaster-recovery-certification)
- [Operational Resilience Certification](https://blog.bcm-institute.org/operational-resilience/operational-resilience-certification)
- [Operational Resilience Audit Certification](https://blog.bcm-institute.org/operational-resilience-audit)
- [Seminars](https://blog.bcm-institute.org/meet-the-expert/mte-webinar-mainpage)
- [Store](https://www.bcm-institute.org/store-2/)
- [Contact Us](http://www.bcm-institute.org/about-us/contact-us/)
-
-
###### \[OR\] \[AmB\] \[E2\] \[P2\] \[S1\] \[C9\] Identifying Critical Business Services
![BB OR \[B\] 3](https://blog.bcm-institute.org/hs-fs/hubfs/BB%20OR%20%5BAi%20Gen%20Blog%20Photo%5D/OR%20Pictures%20A/BB%20OR%20Folder%20B/BB%20OR%20%5BB%5D%203.jpg?width=2000&height=1333&name=BB%20OR%20%5BB%5D%203.jpg "BB OR [B] 3")
# \[OR\] \[AmB\] \[E2\] \[P2\] \[S1\] \[C9\] Identifying Critical Business Services
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/8d6d538b-7b42-4bf6-b355-f6178f7bc1f9)
Operational resilience is essential for financial institutions like AmBank Malaysia to ensure that critical business services remain available during disruptions.
As part of the “Implement” phase of AmBank’s Operational Resilience Planning Methodology, the first crucial step is to identify critical business services (CBS).
This step involves recognising the services that, if disrupted, could significantly impact customers, financial stability, and regulatory compliance. Here’s an in-depth look at how AmBank Malaysia can systematically implement this stage, along with relevant examples.
### [](https://cta-redirect.hubspot.com/cta/redirect/3893111/51659e94-db97-4e76-bfc4-5cae0e0a7e0c)
[Moh Heng Goh](https://blog.bcm-institute.org/ebook-or/author/moh-heng-goh) Jan 22, 2026
###### Operational Resilience Certified Planner-Specialist-Expert
### [![x \[OR\] \[AmB\] Legal Disclaimer Banner](https://no-cache.hubspot.com/cta/default/3893111/c17ea734-ce39-46d1-9b00-ce39367ccfc1.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/c17ea734-ce39-46d1-9b00-ce39367ccfc1)
### [](https://cta-redirect.hubspot.com/cta/redirect/3893111/51659e94-db97-4e76-bfc4-5cae0e0a7e0c)
### Identifying Critical Business Services in Operational Resilience Planning for AmBank Malaysia
###### (Stage of the “Implement” Phase – Operational Resilience Planning Methodology for Metrobank)
#### Introduction
[![\[OR\] \[AmB\] \[E2\] \[P2\] \[S1\] \[C9\] Identifying Critical Business Services](https://no-cache.hubspot.com/cta/default/3893111/0342e980-d543-4d78-ae04-f5d090443268.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/0342e980-d543-4d78-ae04-f5d090443268)Operational resilience is essential for financial institutions like AmBank Malaysia to ensure that critical business services remain available during disruptions.
As part of the “Implement” phase of AmBank’s Operational Resilience Planning Methodology, the first crucial step is to identify critical business services (CBS).
This step involves recognising the services that, if disrupted, could significantly impact customers, financial stability, and regulatory compliance. Here’s an in-depth look at how AmBank Malaysia can systematically implement this stage, along with relevant examples.
#### Implementation Steps for Identifying Critical Business Services
##### Step 1: Define Critical Business Services (CBS)
A critical business service delivers essential financial functions to customers and the wider economy. These services must be end-to-end, spanning people, processes, technology, facilities, and third-party dependencies.
Example (Retail Banking)
- Online banking, ATM withdrawals, and payment processing are considered critical because they support daily financial transactions for customers.
- If AmBank’s mobile banking app experiences downtime, customers may be unable to transfer funds or pay bills, leading to reputational damage and regulatory concerns.
Refer to eBook 1, Chapter 5: Identifying Critical Business Services
##### Step 2: Engage Key Stakeholders for Service Identification
A cross-functional approach ensures that all perspectives are considered. Stakeholders should include:
- Business unit heads (e.g., retail banking, corporate banking, treasury operations)
- Risk management teams
- IT and cybersecurity teams
- Compliance and regulatory teams
Example (Corporate Treasury Services)
- AmBank’s corporate clients rely on real-time cash management and treasury services.
- The Treasury team identifies that SWIFT payments and interbank fund transfers are critical services because disruptions could impact large-scale corporate transactions.
##### Step 3: Map End-to-End Service Dependencies
Mapping out the full service delivery chain helps AmBank understand the key dependencies required for operational resilience.
Example (Trade Finance Services)
- Trade finance services require multiple components:
- Process: Trade document verification and approval
- Technology: Core banking system, secure payment gateways
- People: Relationship managers and trade finance officers
- Third-party: Correspondent banks and customs clearance systems
By mapping these dependencies, AmBank can identify single points of failure and develop contingency measures.
##### Step 4: Assess Impact of Service Disruptions
AmBank must evaluate the potential financial, reputational, and regulatory consequences of a service disruption.
Example (Card Payment Processing)
- If AmBank’s credit and debit card transaction processing fails, it could:
- Prevent customers from making purchases
- Led to regulatory scrutiny from Bank Negara Malaysia (BNM)
- Result in financial losses from declined transactions and customer attrition
By quantifying the impact of such disruptions, AmBank can prioritise resilience measures for high-risk services.
##### Step 5: Validate and Approve the CBS List
Once the critical business services are identified, AmBank should:
- Validate the list with senior management and the board.
- Ensure alignment with regulatory expectations (e.g., Bank Negara Malaysia’s Risk Management in Technology guidelines).
- Regularly update the CBS list to reflect changing business and risk environments.
Example (Digital Banking Services)
- As digital banking adoption increases, AmBank must validate that its internet banking platform, real-time payment services, and e-wallet integrations are classified as CBS.
##### **[![\[Banner\] \[Summing\] \[OR\] \[E2\] \[C9\] Identifying Critical Business Services](https://no-cache.hubspot.com/cta/default/3893111/cb992006-3907-45e5-baa5-922fb1ab3267.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/cb992006-3907-45e5-baa5-922fb1ab3267)**
Identifying critical business services is a strategic and operational imperative for Metrobank’s operational resilience journey.
By systematically mapping Metrobank’s CBS Codes (CBS-1 to CBS-12), assessing criticality, mapping dependencies, setting tolerance for disruption, prioritising resilience efforts, and embedding ongoing review and compliance reporting, Metrobank positions itself to weather disruptions—from natural disasters to cyber events—and to maintain uninterrupted delivery of services to its customers and the real economy.
With the BSP’s guidelines as a benchmark, this stage paves the way for robust continuity planning, testing, and recovery phases that follow in the operational resilience methodology.
| ##### Operational Resilience Framework: A Case Study of AmBank Malaysia | | | | | |
| --- | --- | --- | --- | --- | --- |
| ##### "Implement" Phase of the Operational Resilience Planning Methodology | | | | | |
| **C8** | **C9** | **C10** | **C11** | **C12** | **C13** |
| [![\[OR\] \[AmB\] \[P2\] \[S1-S5\] \[C8\] Five Stages of the _Implement_ Phase](https://no-cache.hubspot.com/cta/default/3893111/28d33a62-1830-447f-85f9-0136fa6c0368.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/28d33a62-1830-447f-85f9-0136fa6c0368) | [![\[OR\] \[AmB\] \[E2\] \[P2\] \[S1\] \[C9\] Identifying Critical Business Services](https://no-cache.hubspot.com/cta/default/3893111/0342e980-d543-4d78-ae04-f5d090443268.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/0342e980-d543-4d78-ae04-f5d090443268) | [![\[OR\] \[AmB\] \[E2\] \[P2\] \[S2\] \[C10\] Mapping of Processes and Resources](https://no-cache.hubspot.com/cta/default/3893111/592744eb-a3d6-4a6b-b947-9559be2b88b4.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/592744eb-a3d6-4a6b-b947-9559be2b88b4) | [![\[OR\] \[AmB\] \[E2\] \[P2\] \[S3\] \[C11\] Establishing Impact Tolerance](https://no-cache.hubspot.com/cta/default/3893111/a0500188-1c47-474b-a500-46ee9b133b5e.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/a0500188-1c47-474b-a500-46ee9b133b5e) | [![\[OR\] \[AmB\] \[E2\] \[P2\] \[S4\] \[C12\] Performing Scenario Testing](https://no-cache.hubspot.com/cta/default/3893111/10898e15-fb18-4c94-b9a4-6b10ab433dbe.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/10898e15-fb18-4c94-b9a4-6b10ab433dbe) | [![\[OR\] \[AmB\] \[E2\] \[P2\] \[S5\] \[C13\] Improving Lessons Learned](https://no-cache.hubspot.com/cta/default/3893111/7643650a-0ef1-4059-9e68-ae5da0188c04.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/7643650a-0ef1-4059-9e68-ae5da0188c04) |
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/084e620a-46c5-419a-82ed-6a681d15c0b6)Gain Competency: For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the OR-5000 Operational Resilience Expert Implementer course, provide in-depth insights and practical toolkits for effectively embedding this model.
#### More Information About OR-5000 \[OR-5\] or OR-300 \[OR-3\]
To learn more about the course and schedule, click the buttons below for the OR-300 Operational Resilience Implementer course and the OR-5000 Operational Resilience Expert Implementer course.
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/3530eccb-515d-401e-afc2-3469e26d7fbf) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/fdd4fa9c-ed69-40c1-925f-4eb6a1c5c255) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/77a34b84-0a6d-44f8-b8d6-6ab04cdf5edd) |
| --- | --- | --- |
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/6e5c0cda-39b9-4bbd-b3d4-4cf46a790b14) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/a68a08aa-36d3-4216-9551-202c9fde06ea) | [![ \[BL-OR\] \[3-4-5\] View Schedule](https://no-cache.hubspot.com/cta/default/3893111/d0d733a1-16c0-4b68-a26d-adbfd4fc6069.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/d0d733a1-16c0-4b68-a26d-adbfd4fc6069) |
| [![\[BL-OR\] \[3\] FAQ OR-300](https://no-cache.hubspot.com/cta/default/3893111/f20c71b4-f5e8-4aa5-8056-c374ca33a091.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/f20c71b4-f5e8-4aa5-8056-c374ca33a091) | If you have any questions, click to contact us.[![Email to Sales Team \[BCM Institute\]](https://no-cache.hubspot.com/cta/default/3893111/3c53daeb-2836-4843-b0e0-645baee2ab9e.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/3c53daeb-2836-4843-b0e0-645baee2ab9e) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/7f2718a4-ea80-4f84-a319-dc2d4df37a46) |
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/74b1e556-8cd2-4a74-8821-db1804534955) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/f2bd8eb1-32d2-4732-9267-ea53223cf58f) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/084e620a-46c5-419a-82ed-6a681d15c0b6) |
#### **Comments:**
---
---
---
---
All rights reserved. Copyright 2026
```json
{
"@context" : "https://schema.org",
"@type" : "BlogPosting",
"author" : {
"@type" : "Person",
"name" : "Moh Heng Goh",
"url" : "https://blog.bcm-institute.org/ebook-or/author/moh-heng-goh"
},
"dateModified" : "2026-01-22T08:45:43.507Z",
"datePublished" : "2026-01-22T08:13:10.000Z",
"headline" : "[OR] [AmB] [E2] [P2] [S1] [C9] Identifying Critical Business Services",
"mainEntityOfPage" : {
"@id" : "https://blog.bcm-institute.org/ebook-or/or-amb-e2-p2-s1-c9-identifying-critical-business-services",
"@type" : "WebPage"
},
"publisher" : {
"@type" : "Organization",
"logo" : {
"@type" : "ImageObject",
"url" : "https://blog.bcm-institute.org/hubfs/BCMI%20Logo.png"
},
"name" : "BCMI Pte Ltd"
}
}
```